| Package | Affected versions | Patched versions |
|---|---|---|
| ruby | = 2.6.0≥ 2.3.0, < 2.3.7≥ 2.4.0, < 2.4.4≥ 2.5.0, < 2.5.1< 2.2.10 | 2.3.72.4.42.5.12.2.10 |
In Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1, the Dir.open, Dir.new, Dir.entries and Dir.empty? methods do not check NULL characters. When using the corresponding method, unintentional directory traversal may be performed.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free